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Quadratic Gaussian Privacy Games 

Farhad Farokhi, Henrik Sandberg, Iman Shames, and Michael Cantoni 


Abstract —A game-theoretic model for analysing the effects of 
privacy on strategic communication between agents is devised. 
In the model, a sender wishes to provide an accurate measure¬ 
ment of the state to a receiver while also protecting its private 
information (which is correlated with the state) private from 
a malicious agent that may eavesdrop on its communications 
with the receiver. A family of nontrivial equilihria, in which 
the communicated messages carry information, is constructed 
and its properties are studied. 

I. Introduction 

Modern infrastructures, such as smart grids and intelligent 
transportation systems, are typically composed of smaller 
entities that cooperate in providing services whilst competing 
to generate revenue. These entities wish to retain a certain 
level of autonomy and privacy, which renders the task of 
guaranteeing a reasonable level of performance arduous. A 
new framework is required for modelling, understanding, and 
mitigating the challenges arising from the need for privacy 
and autonomy. To this aim, in this paper, we develop a game- 
theoretic setup for modelling and analysing the effects of 
privacy on strategic^ communication. 

Specifically, we consider strategic communication between 
a sender and a receiver when a malicious agent can eavesdrop 
on their transmitted messages. The sender has the inten¬ 
tion to provide accurate measurements of the state to the 
receiver, however, at the same time, it would like to hide its 
private information (which is correlated to the state-to-be- 
estimated) from the malicious agenj^ We present a game- 
theoretic framework for modelling the interaction between 
these agents. Subsequently, we define an equilibrium as a 
tuple of policies from which no one has any incentive to 
unilaterally deviate. We study the properties of the equilib¬ 
rium as function of the privacy ratio, a parameter that reflects 
the balance between the sender’s intention for providing an 
accurate measurement of the state to the receiver and its 
desire for privacy against the malicious agent. 

F. Farokhi, I. Shames, and M. Cantoni are with the Department of Elec¬ 
trical and Electronic Engineering, The University of Melbourne, Parkville, 
Victoria 3010, Australia. Their work was supported by a McKenzie Fel¬ 
lowship, the Australian Research Council (LP130100605), and Rubicon 
Water Pty Ltd. Emails: {ffarokhi,ishames,cantoni}@unimelb.edu.au 

H. Sandberg is with the ACCESS Linnaeus Center, School of Electrical 
Engineering, KTH Royal Institute of Technology, SE-100 44 Stockholm, 
Sweden. Email: hsan@kth.se 

*The term “strategic” in “strategic communication” refers to that the 
participants (the sender, the receiver, the eavesdropper, etc) can identify 
their objectives and find the best policy for achieving these objectives in 
response to the actions of the other parties. 

^Note that the receiver and the malicious agent need not be separate 
entities. Eor instance, in many cases, we would like to provide some 
information to for-profit organizations in return for services, however, we 
wish to retain the rest of our personal data private to avoid being scammed 
through, among various means, targeted advertisement. 



Eig. 1. The communication structure between the strategic sensor S, other 
sources of information z, the malicious agent M, and the receiver R. 


The problem that is considered in this paper is partly 
related to studies in differential privacy and its application in 
control and estimation [l]-[4]. In those studies, the commu¬ 
nicated messages are typically perturbed by noise to ensure 
differential privacy. In this paper, we take a completely 
different approach to model and to understand the balance 
between privacy and the underlying objective of communica¬ 
tion, that is, providing useful information to a less-informed 
third party. This framework results in different insights. For 
instance, in turns out that, in some cases, we do not need to 
add noise to the communicated signals at the equilibrium 
of the introduced privacy game. Furthermore, this paper 
provides an average-type privacy whereas the approach in 
the differential privacy literature gives a worst-case analysis 
(using information-theoretic tools one can bound the amount 
of the total leaked information). 

We should note that the model and the results in this paper 
are, particularly, related to the cheap-talk literature [5]-[7]. 
A cheap-talk game is a strategic communication game in 
which well-informed players transmits messages to a receiver 
that makes a final decision regarding social welfare of all 
the players. Recently, these results were utilized in [8] to 
develop a framework for strategic communication between 
self-interested sensors and an estimator. In this paper, we 
utilize those ideas to develop a specific family of cheap-talk 
games in which the conflict-of-interest between sensors and 
the receiver is caused by the desire for privacy. Subsequently, 
this family of games is analysed using the tools developed 
in [8]. 

The rest of the paper is organized as follows. In Section [11] 
we introduce the privacy game and define the equilibrium 
for the game. We determine a family of equilibria and study 
its properties in Section [ml Finally, we present a numerical 
example in Section IV and conclude the paper in Section |V] 


II. Problem Formulation 

We consider the communication structure (see Fig. [^l in 
which a sender S transmits a message y G over a real 
channel to a receiver H. The sender has the best intention 











to provide an accurate measurement of a variable x G 
to the receiver. However, it also wishes to keep its private 
information w G M"™ hidden from any malicious agent 
who can tap the channel and eavesdrop on its transmitted 
message. This is certainly not a trivial task if x and w are 
correlated (as, in such cases, measurements of x carry “some 
information” about the realization of w). We also assume 
that the receiver and the malicious agent can, in addition to 
the message provided by the sender, access other sources 
of information (e.g., other senders, physical sensors, etc) to 
receive the measurement z G . Throughout the paper, we 
use the notation Vxy to denote for any two random 

variables x and y. We make the following assumption. 

Assumption 1: x,w,z are jointly distributed Gaussian 
random variables with zero mean and a positive-definite joint 
covariance matrix. 

The timing of the game is as follows. First, the random 
variables x,w,z are realized. Then, the sender determines 
and transmits its message y. Note that, at this point, we 
assume that the sender has access to the realization of z, 
however, as will see, at the equilibrium, the sender does not 
utilize the realization (but uses the probability distribution). 
Subsequently, the receiver constructs its best estimate of the 
state X. At the same time, a malicious agent constructs the 
best estimate of the private information w of the sender 
from the available information y and z. Finally, all the cost 
functions are realized. Note that all the distributions are 
assumed to be common knowledge in the game (i.e., each 
player knows them, each player knows that the other players 
know them, and so on). Let us introduce each player in the 
game properly. 


A. Receiver 

The receiver constructs its best estimate of the state, 
denoted by x G according to the conditional probability 
density distribution '(p{-\y,z). Therefore, for all Lebesgue- 
measurable sets X C we have 

P{x G X\y, z}= [ ^{^\y, 2 )d^. 

Let T* denote the set of all such conditional probability den¬ 
sity distributions (i.e., the set of all non-negative Lebesgue- 
measurable functions with integral over equal to one). 
The receiver is interested in having a small estimation error 
for the state E{||x — xjH}. 


B. Malicious Agent 

The malicious agent constructs its best estimate w ac¬ 
cording to the conditional probability density distribution 
(j){-\y,z). Therefore, similarly, for all Lebesgue-measurable 
sets W C M”™, we get 

P{w G W\y, z}= [ z)dC. 

J^ew 

The set of all such conditional distributions is denoted by 
$. What distinguishes the sets T' and $ is the dimensions 
of the vectors x and w. The cost function of the malicious 
agent is E{||r(; — tu|||}. 


C. Sender 

The sender employs a conditional probability density 
distribution 7 (-|x,u;) for all x G and w G K””, which 
gives that 


V{y&y\x,w}= [ 7(C|x,u;)d^, 

where y C is any Lebesgue-measurable set. The set 
of all such conditional probability density distributions is 
denoted by F. The cost of the sender is E{||x — xjl^} — 
()E{||u; — r&ll^}, where <5 G IR>o is the privacy ratio. As 
S increases, the sender puts more emphasis on keeping its 
privacy instead of helping the receiver by proving a useful 
message for the state estimation to the receiver. 


D. Equilibrium 

With these definitions at hand, we are now ready to define 
the equilibrium of the game. However, first, we need to define 
some useful notations. In that what follows, we use and 
<I)^ to denote the sets of all mappings from F to, respectively, 
T' and $. Hence, for any tp G and any given 7 , ip{'j) is a 
conditional probability density distribution in T'. We use the 
notation [ip{'j)]{x\y, z) to distinguish between the arguments 
of Ip and tp{'y). The same can be said about the entries of 

Definition 1: A tuple {p)*,(p*,^*) G 5''" x <I)^ x F is 
an equilibrium of the privacy game with privacy ratio 6 if 

G argminEj f [ \\x - x\\l[ip{'y*)]{x\y, z) 

i/ie'T'" I JyeK^y 

X 7 *(y|x, w)dydx|, (la) 

G argminEj f f \\w - w\\l[(p{'y*)]{w\y, z) 

(peM I JiDeR"™ Jj/6R"y 

X 7*(y|x, w)dyd'u)|’, (lb) 

7 *GargminE| f [ \\x - x\\l[ip*{'y)]{x\y, z) 

76r ( JiGR"x Jj/6R"» 

X 7(t/|x, tu)dt/dx 

-sf f \\w - w\\l[(p*{'y)]{w\y,z) 

X 7 (y|x, ■u;)dt/d'u;|’. (Ic) 

In some cases, the policies of the malicious agent and 
the receiver are set by the same entity. For instance, we may 
want to provide some information to a for-profit organization 
in return for services, however, we wish to retain the rest of 
our personal data private to avoid being scammed through 
targeted advertisement from the same organization. The 
following definition capture such scenarios. 

Definition 2: A tuple {'tp*,(p*,j*) G x <!)’" x F is 
an equilibrium of the privacy game with privacy ratio 6 if 



7* satisfies and 


{ip*, Ip*) G argmin E 


\\x - x\\l[ip{-f*)]{x\y, z) 


L JxGR"=: JyGR"» 

X 'Y*{y\x, w)dydx 

d f [ \\w - w\\l[p{'j*)]{w\y,z) 

JiiGK"™ JyeR^y 

X 7*(j/|a:, w)d2/dt() > (2) 


interested in any of these equilibria. In the next theorem, we 
construct a nontrivial equilibrium for the privacy game. 

Theorem 3; For any <5 G K>o, there exists an equilib¬ 
rium {ip*,p*,"f*) G X X r in which 

i) The receiver employs the policy ip* such that 
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for a given constant i9 > 0. 

Theorem 1: A tuple {ip*,p*,^*) G x x T is an 
equilibrium of the privacy game with privacy ratio 5 in the 
sense of Definition if and only if it is an equilibrium in 
the sense of Definition [T] 

Proof: The first term under expectation in (|^ is only 
a function of ip and the second term is only a function of 
p. Therefore, we can separate this optimization problem into 
two parts as in ( [Tal l ( [Tb] l. ■ 

Theorem shows that there is no loss of generality in 
assuming that the receiver and the malicious agent are two 
separate entities as in Definition 

Remark 1: The equilibrium in Definition [^ (and equiva¬ 
lently that of Definitionis a Stackelberg equilibrium rather 
than a Nash equilibrium. This is because, in the definition 
of a Nash equilibrium, the players are not allowed to change 
their policy (they select one and fix it in response to all that 
the others can do). However, in this definition, clearly, both 
the receiver and the malicious agent are able to set their 
policies (i.e. estimate generating conditional densities ip{'y) 
and p{'j)) in response to the selected policy of the sender 7. 

In the next section, we construct a family of privacy-game 
equilibria. 


ii) The malicious agent employs the policy p* such that 
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Hi) The sender employs the policy 7* such that 


y = K*x -h K*^w + V, 


where 


r K*^ 

X 

K*^ 

L w 


G arg min Tr ATS 

Xny \ 


-I 

0 


s.t. KEK^ < I, 


0 

SI 




Vxx 

Vxw 


■ K,, ■ 

T 

■ K. ■ 

Vwx 

V'HJW 
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zz 

V'txz 


and V G K" is a Gaussian random variable independent 
of X, w, z with zero mean and variance 


III. Main Results 

As any other cheap-talk game, this game posses an array 
of non-informative trivial equilibria, which are known as 
babbling equilibria in the economics literature [6]. The next 
theorem constructs these babbling equilibria in the privacy 
game in line with Definition [T] 

Theorem 2; Let 'Y*{y\x,w) = Py{y), where Py{-) is an 
arbitrary probability density distribution. Moreover, let ip* 
and p* be, respectively, selected such that x = E{a;| 2 } 
and w = E{u;|z} almost surely. Then, {ip*,p*,'y*) is an 
equilibrium of the privacy game with any privacy ratio. 

Proof: Since the sender does not provide any viable 
information about the state-to-be-estimated and so y and x 
are statistically independent, the best policy of the receiver 
and the malicious agent is to ignore the message y. Similarly, 
if the receiver and the malicious agent are ignoring the 
sender’s message, its cost function does not change by the 
choice of its policy (i.e., the conditional density function for 
selecting its message) and so it might as well not provide 
any viable information. ■ 

At these equilibria, all the players purely randomize and 
disregard all the available information to them. We are not 


[K* K*^]E 

Furthermore, for all k G such that det(K) f 0, 

{ip* ,p*, Kj*) constitutes an equilibrium. 

Proof: First, we fix ip* and p* as in the statement of the 
theorem and show that the presented 7* is the best response 
of the sender. Let us assume that Vyy — 14i/ = I- 

This is without loss of generality as the receiver can always 
scale the communicated message to ensure this is satisfied. 
To show this, assume that Vyy — VyzVf^^Vzy = D G 
where denotes the set of positive-definite matrix in 

j^nyxriy^ Note that Vyy — VyzVfz^Vzy G 5 "!^ follows from 
Schur complement and Assumption Now, the receiver can 
simply use y = D-^/'^y, which gives Vyy - VyzV~^Vzy = 
£)-i/ 27 )£)-i /2 _ j (Since the transformation between y 
and y is one-to-one, it does not create any information loss.) 
Under this assumption, using the matrix inversion lemma, 
we get 
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E{||a: - i|| 2 } - SE{\\w - u;|| 2 } = Tr(T4. - - 5Tr(K,^ - 
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-SV-^V,^ -Kz^(14.14z - SV,^V^,)V, 
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■ ( 3 ) 


Note that 

E{||a;-^||2} 
= E 


[ ^xy 




Vyy Vyz 

^zy Vzz 


-1 


Vyy K, 


= Tr Vxx-[ Vxy ] 

V L 

= TriVxx - VxyVyx + VxyVyxV-W,x + Kz^z'^.y^/. 


V,y V, 


'zz 
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1 

z 





n 

2 ) 

Vyx 


_ 14 . 

) 


xy’yz' 
-1 , TZ-1^ 


- VxAV-W.yVy,V-/ + V-^)V.x) 

= Tr(V^x - Vx.V-^V,x)+TT{-VyxVxy + Vy,V-^V,xV. 
+ VyxVx.V-^V.y - VyxV-^V.xVx.V-^V.y). 

Similarly, we have 


E{||w-WII 2 } 


= E 


w 


-[K 


wy 


Vn, 


Vyy Vy; 

14 . F,; 


= Tr(K;„ - 14,zV;Z^^Z») + T'^i-VywVyjy 
+ VyzV^J'VzwVwy + VyxuVwzVz;z:^Vzy 
- VyzV-^Vz^Vz,zV-^Vzy). 

Therefore, we get the equality in (|^ on top of the page. 
Notice that, in this cost function, we have 
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0 

Z-ll 


0 

61 


VxzV-^ 
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14 - 114 . < 514 - 114 ^ -v-\VzxVxz - SVz^V^zW,, 
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Let us call this matrix Z. Moreover, we have 
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Using Schur complement, the inequality in 0 can be rewrit¬ 
ten as 



Vxy 

T 

'^xx 

Vxw 

Vxz ' 

-1 

Vxy 


Vyy 

^wy 


'^wx 

Vww 

Vwz 


V'lxy 

> 0 . 


. Vzy _ 


_ Vzx 

Vzw 
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. Vzy _ 

( 5 ) 


Recalling that 14 ^ — Vy^V^z^^zy = the inequality in Q 
can be posed as 


I- 


Vxy 

V 

Vzxy 
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Vxx 
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Vx 
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0 

0 

U“1 

zz 

-IN 


wz 

'zz 
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> 0. (6) 


Following the same argument as in the proof of Theorem 2.2 
in [9], we can show that the inequality in (|^ holds if and 
only if 


Vxy 

T 

Vxy 

Vxuy 

Q 

Vwy 

. V^y . 


. Vzy _ 


< /, 


where 

Q = 


-VxzV-^ 

-Vn,zV-^ 


Vxx 

Vxw 


■ 4 ,, ■ 

U"! 

■ 44, ■ 


Vujx 

Vin'nj 


Vinz 

zz 

Vwz 
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I 0 
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-44zi4z' 


I -K,zl4z' 


Thus, the best response of the sender is given by solving the 
optimization problem 


min Tr 

Ley jLuy Tsy 


i 

Vxy 

T 

Vxy 

\ 


^wy 


V'txy 


\ 

. Vzy _ 


. Vzy _ 

/ 



Vxy 

T 

Vxy 

s.t. 

^wy 

Q 

Vwy 


. Vzy _ 


. Vzy _ 


< /. 


(7a) 


(7b) 


It remains to show that an affine policy can be optimal in 
this sense. Let 

y = KxX + KyjW + KzZ + v, 

where u is a zero-mean Gaussian random variable, which is 
independent of x,w,z. Simple calculations show that 


Vxy 
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and, as a result. 
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where the inverse exists thanks to AssumptionIntroducing because 
the change of variable 
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in 0 yields the equivalent optimization problem 

Tr ( 8 a) 

< /, ( 8 b) 


X = arg min 

s.t. 


where 
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Let us define 

A' = 


arg min Tr 

^'GM(na;+ny) Xriy 




s.t. 


Cq"£.' < I, 


(9a) 
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where 
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-ii 

xz'f ZZ ' Z.X 
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yxx - yxzK-^y 
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0 SI 
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xz^ ZZ ^ ZX 

-It, 

ZX 


K,X - KxzKz'^Z 


yx^ - KzT4i^i4«, 

yww ^^z^^z: yzw 


for all G Hence, there is an equilibrium for 

which Kz = 0 because X' ^ 0 (as its cost function is 
continuous and the feasible set is compact). The rest of 
the proof follows easily from the fact that once we use the 
sender’s strategy in the statement of theorem (which is an 
affine function in the realization of the random variables 
X, w), the best estimator that the receiver and the malicious 
agent can utilize is the least mean square estimator in the 
statement of the theorem. ■ 

Remark 2: Note that the policies ip* and cp* at the 
equilibrium constructed in Theorem are affine in the 
realizations of the random variables y and z. However, these 
policies are overall not affine as Vxy , 142 , yyz, yyy, and 14 z 
are all functions of the distributions of the random variables 
z and y (albeit not their realizations). This also shows that 
ip* and (p*, at the equilibrium, are functions of 7 (i.e., the 
policy of the sender). 

Solving the optimization problem in Theorem is a 
tedious task even numerically as the problem is not convex. 
Note that since we are interested in finding an equilib¬ 
rium, approximations are not particularly useful (since, at 
an approximate solution, an agent might have an incentive 
to unilaterally change its policy and, thus, the equilibrium 
breaks down). In such cases, the definition of the equilibrium 
should be adapted accordingly. This problem can be an 
avenue for future research. In the next corollary, we focus 
on the case where we can solve this optimization problem 
explicitly. 

Corollary 4: Let ny = 1. For any S G K>o, there 
exists an equilibrium {ip*, (p* jj*) G x 4)^ x L in which 

i) The receiver employs the policy ip* such that 
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ii) The malicious agent employs the policy (p* such that 
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HI) The sender employs the policy 7 * such that 
¥{y = K^x + K*^w} = 1, 


where 


y wx ywzyzz y zx 

y ww 

y wz >^22 y zw j 

1 ATx 1 

Vxx Vxw 


Kz 

v~^ 

T 4 z 


^x 

Kw 

Vwx Vww 


Vwz 

ZZ 

Vwz 




= 


= 1 


Evidently, 




C' GX'icX, 


with being the normalized eigenvector corresponding 
to the smallest eigenvalue of 5^/^ diag(—/, SI)'E}/'^. 
Furthermore, for all k 7 ^ 0, {ip* ,(p*, kj*) constitutes an 
equilibrium. 
































































Fig. 2. Estimation error of the receiver and the malicious agent as a 
function of the privacy ratio. 

Proof: The proof follows from applying Lemma A.l 
in [9] to the results of Theorem ■ 

Remark 3 ; Corollary shows the maybe surprising fact 
that the privacy-preserving policy of the sender at the calcu¬ 
lated family of equilibria is deterministic if the message from 
the sender is scalar, i.e., Uy = 1. It should be noted that the 
equilibrium in this game is not necessarily unique. Therefore, 
there might exist an equilibrium (in addition to the babbling 
equilibria; see Theorem that consists of randomization. 
Unfortunately, for the rest of the cases, there is no systematic 
way to construct an explicit policy for the sender at the 
equilibrium. 

IV. Numerical Example 

Let us consider the case where there is no side information. 
Set Ux = rixu = Uy = 1 and fix 
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Fig. 0 shows the estimation error of the receiver and the 
malicious agent at the calculated equilibrium with k = 1 
as a function of the privacy ratio S. Indeed, as the privacy 
ratio S increases, the estimation error of the malicious agent 
increases and, finally, converges to Vww Therefore, the 
sender keeps w completely private. However, this happens 
at the price of a larger estimation error of the state at the 
receiver. 

Fig. [^illustrates the estimation error at the receiver E{||a;— 
fill} as a function of the privacy ratio 6 and the correlation 
between the state and the private information captured by 
Vxw For a fixed privacy ratio, as we increase Vxw the quality 
of the estimation degrades since if the correlation is high 
an accurate measurement of x conveys a lot of information 
about the realization of w. 

V. Conclusions and Future Work 

A game-theoretic framework for modelling and analysing 
the effect of privacy in strategic communication between var¬ 





Fig. 3. Estimation en'or of the receiver as a function of the privacy ratio 
and the correlation between the state and the private information. 

ious entities is developed. A well-informed sender wants to 
provide an accurate measurement of the state-to-be-estimated 
to a receiver. However, the sender also desires to keep 
its private information private from a malicious agent. The 
private information and the state are assumed to be correlated 
and, hence, an accurate measurement of the state also shines 
some light on the realization of the private information. The 
trade-off between the desire to keep privacy and transmitting 
a useful measurement to the receiver is captured using the 
privacy ratio. For scalar messages, the policy of the sender, at 
the calculated equilibrium, is deterministic. A viable avenue 
for future work is to extend the setup to more than one 
sender. 
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